OSIR cheat sheet

CIA triad: Confidentiality (authorized disclosure only), Integrity (unmodified, trustworthy data), Availability (timely, reliable access).

Incident response lifecycle (NIST SP 800-61): Preparation → Detection & Analysis → Containment, Eradication & Recovery → Post-Incident Activity.

PICERL (SANS): Preparation, Identification, Containment, Eradication, Recovery, Lessons Learned.

Mean Time to Detect (MTTD) = total detection time ÷ number of incidents; Mean Time to Respond (MTTR) = total response time ÷ number of incidents.

Incident vs. event: an event is any observable occurrence; an incident is an event (or series) that actually or potentially jeopardizes CIA.

Severity classification typically uses impact (data sensitivity, business function) × likelihood; critical incidents trigger executive notification and out-of-band communications.

SOC tiers: Tier 1 triage/alert validation, Tier 2 deeper investigation and containment, Tier 3 hunting/threat intel/advanced forensics.

Chain of custody begins at first contact; record who collected, when, where, and how, and every transfer thereafter.

Regulatory notification clocks vary (e.g., GDPR 72 hours to supervisory authority; sector rules may be shorter) - verify the applicable rule before promising a timeline.

Detection fidelity metrics: True Positive Rate (Recall) = TP ÷ (TP + FN); False Positive Rate = FP ÷ (FP + TN); Precision = TP ÷ (TP + FP).

SIEM correlation rule anatomy: log source → normalization/parsing → condition logic → threshold/time window → severity → response action.

Signature detection matches known patterns (hashes, YARA, Snort/Suricata rules); anomaly detection baselines normal behavior and flags deviation; both produce false positives.

MITRE ATT&CK tactics are the 'why' (e.g., Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Command and Control, Exfiltration, Impact).

Alert triage decision rule: validate the event is real → determine scope (hosts, accounts, data) → assign severity → escalate or close with documented rationale.

Log retention and time synchronization (NTP) are prerequisites; skewed clocks break correlation and timeline reconstruction.

Behavioral indicators to monitor: impossible travel, anomalous login times, new service/account creation, spikes in failed logons (e.g., 4625), unusual outbound volume.

Threat intelligence feeds (IOC: IP, domain, hash, URL) should be aged and scored; stale IOCs cause false positives.

Use cases should be tested with known-bad and known-good samples before production; document expected vs. observed results.

Containment options: isolate host from network, disable account, block IP/domain at egress, revoke tokens/sessions, segment VLAN; choose based on business impact and evidence preservation.

Order of volatility (RFC 3227): CPU registers/cache → RAM → network state → running processes → disk → logs → backups/archives → printed media.

Eradication removes root cause (malware, vulnerable service, compromised credential); recovery restores trusted state and validates with monitoring.

Do not power off a live system before volatile capture unless the system is actively causing harm; pulling the plug destroys RAM evidence.

Containment decision rule: if the threat is spreading, contain first; if the host holds critical evidence and spread is contained, image first.

Communication plan: designated spokesperson, predefined escalation matrix, status cadence, and legal/PR review for external statements.

Lessons learned should produce tracked corrective actions with owners and due dates, not just a narrative.

Preserve original evidence: hash before and after acquisition; work from copies; document tool versions and commands used.

For ransomware: isolate affected segments, preserve encrypted samples and logs, identify patient zero, check backups for integrity before restore.

Forensic image hash (e.g., SHA-256) computed at acquisition and re-verified at analysis proves integrity; any mismatch invalidates the copy.

Write blockers prevent modification of source media during acquisition; hardware or software blockers both acceptable if documented.

Disk image formats: raw (dd/E01), EnCase E01 (with metadata), AFF; document format and tool version.

Memory acquisition captures running processes, network connections, encryption keys, and injected code not present on disk.

Timeline analysis correlates file system MAC times (Modified, Accessed, Changed/MFT, Created) with log and registry timestamps; note time zone and NTP skew.

Windows artifacts: Event logs (Security 4624/4625/4688), Prefetch, Amcache, ShimCache, UserAssist, SRUM, $MFT, $UsnJrnl, registry hives.

Linux artifacts: /var/log/auth.log, syslog, wtmp/btmp, bash_history, /proc, cron, systemd journal.

Deleted-file recovery depends on file system (NTFS $MFT/$LogFile, FAT directory entries); carving recovers content without metadata.

Legal admissibility depends on relevance, authenticity, completeness, reliability, and documented chain of custody - not on a specific tool.

PCAP analysis workflow: identify conversations → filter by protocol/port → follow stream → extract objects → correlate with host logs.

Common display filters: tcp.port==443, ip.addr==x.x.x.x, http.request.method=="POST", dns.qry.name contains "example".

Beaconing indicators: regular interval connections, consistent small payloads, jitter, rare domains, TLS SNI mismatch, long-duration low-volume sessions.

IDS placement: network TAP/SPAN at perimeter and internal choke points; east-west traffic often requires internal sensors.

DNS tunneling signs: high volume of TXT/NULL queries, long subdomain labels, high entropy in query names, unusual query types.

NetFlow/IPFIX gives metadata (5-tuple, bytes, duration) but not payload; combine with full packet capture for content.

TLS inspection requires a proxy/CA; without it, analyze SNI, certificate metadata, JA3/JA3S fingerprints, and flow behavior.

Lateral movement indicators: SMB/RDP/WinRM between workstations, service creation, pass-the-hash patterns (NTLM auth without prior interactive logon).

Egress filtering and proxy logs reveal C2; compare destination reputation, ASN, and first-seen domain age.

Incident report sections: summary, timeline, scope/impact, root cause, evidence, actions taken, recommendations, appendices.

Write for the audience: executive summary (business impact, risk, decisions needed) vs. technical annex (IOCs, commands, logs).

Notification triggers: personal data breach, critical infrastructure impact, contractual SLAs, sector regulators; identify the controlling authority and deadline.

GDPR Article 33: notify supervisory authority within 72 hours of awareness unless unlikely to result in risk; Article 34 to data subjects when high risk.

Preserve evidence and documentation for the retention period required by law, contract, or litigation hold; do not delete logs after closure.

Metrics for reporting: MTTD, MTTR, incidents by severity, false positive rate, containment time, recurring root causes.

External communications require legal and communications review; avoid speculation, attribute carefully, and state what is known vs. unknown.

Compliance frameworks (ISO 27001, NIST CSF, PCI DSS, HIPAA) impose logging, monitoring, and incident response requirements; map controls to evidence.

Post-incident report should be blameless and factual; separate observations from recommendations.